[identity] privileged reset password rpcs

Summary:
Depends on D13759

implement the RPCs introduced in previous diff. we check in both RPCs that the caller is staff. then we just run OPAQUE registration with the new password and replace the old one

Test Plan: tested at the end of stack by calling RPCs from keyserver script

Reviewers: will, bartek

Reviewed By: will

Subscribers: ashoat, tomek

Differential Revision: https://phab.comm.dev/D13760